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United States District Couri 

for the 

Southern District of California 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

8ch. net 

9120 Double Diamond Parkway, Suite 5901, 
Reno, NV 89521 
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Case No. 
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SOUTHERN DISTRICT OF CALIFORNIA 
-- - -DEPUTY 
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application FOR a search warrant case UNSEALED PER ORDER OF C0UR 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): gEE A jj A q HMEN j A 

(INCORPORATED HEREIN) 


located in the 


District of 


Nevada 


, there is now concealed (identify the 


person or describe the property to be seized): 

8ch.net 

SEE ATTACHMENT B 
(INCORPORATED HEREIN) 

The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): 

Ilf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

Sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

18 U.S.C. 247(a)(1), (a)(2) Intentional obstruction, by force or threat of force of persons in the free exercise of 

religious belief, resulting in death; willfully causing bodily injury to persons through 
18 U.S.C. 249(a)(1) the use of a firearm because of the actual or perceived religion of said persons, re 

The application is based on these facts: 

SEE AFFIDAVIT OF SPECIAL AGENT MICHAEL J. ROD, INCORPORATED HEREIN. 

Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. v 

— _ 

Applicant's signature 

_ Special Agent Michael J. Rod, FBI _ 

Printed name and title 


Sworn to before me and signed in my presence. 

Date: 04/28/2019 

City and state: San Dieg o, CA _ 



Printed name and title 
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I, Michael J. Rod, being first duly sworn, hereby depose and state as follows: 

I. INTRODUCTION 

1. This affidavit is submitted in support of an application for a search 
warrant, pursuant to 18 U.S.C. 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), for 
information associated with the following 8chan posting with ID 4e267a and No. 
13192921 (hereinafter the “subject posting”), created by John Earnest and others, 
known and unknown, and stored at the premises owned, maintained, controlled, or 
operated by 8ch.net, 9120 Double Diamond Parkway, Suite 5901, Reno, NV 89521. 

2. As described in further detail below, on April 28,2019, John Earnest, 
armed with an AR15 style rifle, conducted an attack at the Chabad of Poway 
synagogue, injuring three individuals and killing one individual. He was later 
arrested and interviewed and admitted to the Chabad of Poway incident, as well as 
an arson at the Dar-ul-Arqam Mosque and Islamic Center on March 24, 2019. 

3. There is probable cause to believe that within 8chan, more fully 
described in Attachment A, will be found evidence of violations of federal law, 
namely, intentional obstruction, by force or threat of force of persons in the free 
exercise of religious belief, resulting in death, in violation of 18 U.S.C. § 247(a)(2), 
willfully causing bodily injury to persons through the use of a firearm because of the 
actual or perceived religion of said persons, resulting in death, in violation of 18 
U.S.C. § 249(a)(1), and damage to religious property, in violation of 18 U.S.C. § 
247(a)(l), as more fully described in Attachment B. 
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4. I am an investigative or law enforcement officer within the meaning of 
Title 18, United States Code, Section 2510(7); that is, an officer of the United States, 
who is empowered by law to conduct investigations of and to make arrests for 
offenses enumerated in Titles 18 and 21 of the United States Code. 

5. I am a Special Agent of the FBI, and have been so employed since May 
2010.1 am currently assigned to the San Diego Field Division. Prior to joining the 
FBI, I was a United States Marine Corps Judge Advocate serving on active duty 
from November 2001 until May 2010. In my capacity as a Judge Advocate, I 
prosecuted and defended violations of the Uniform Code of Military Justice, acted 
as the Investigating Officer during criminal proceedings, provided legal assistance 
to service members, and advised military commanders on a wide variety of civil and 
administrative matters. 

6. I have received twenty-one weeks of training at the FBI Academy in 
Quantico, Virginia. During that training, I received instruction regarding a wide 
variety of investigative techniques that are commonly used in support of a wide 
range of the FBI’s investigative priorities. The training included instruction 
regarding the use of sources, electronic surveillance techniques, law enforcement 
tactics, search and seizure laws and techniques, surveillance, forensic techniques, 
interviewing, and a variety of other subjects. I have acted as the lead investigator on 
a variety of cases and have participated in multiple cases that have focused on gang 
related matters. 

7. Between July 2012 and February 2019, I was assigned to the North 
County Regional Gang Task Force (NCRGTF). During my time at the NCRGTF, I 
had personal contact with dozens of self-admitted or known gang members and their 
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associates and have discussed their lifestyles, method of operations regarding violent 
and property crimes, and their drug trafficking and drug distributing activities. I have 
participated in investigations involving criminal gang members including but not 
limited to Hispanic criminal street gangs. In March 2019,1 was assigned to the HTTF 
and have assisted in cases involving human trafficking and the sexual exploitation 
of adults and children. The facts set forth in this affidavit are based on my own 
personal knowledge, knowledge obtained from other individuals during my 
participation in this investigation (including other law enforcement officers), my 
review of documents and computer records related to this investigation, and 
information gained through my training and experience. Because this affidavit is 
submitted for the limited purpose of establishing probable cause for a search warrant, 
it does not set forth every fact that I or others have learned during this investigation. 

II. PROBABLE CAUSE 
A. Chabad of Poway Attack 

8. During the course of my current duties, I have learned the following 
from consulting with other state, local and federal law enforcement officers, 
including San Diego Sheriffs Department (SDSD) Detectives, San Diego County 
District Attorney Investigators, and my fellow FBI agents. 

9. On April 27, 2019 at approximately 11:23 am. San Diego Sheriffs 
Communication Center received a 911 call of shots fired at the synagogue located 
on Chabad Way in Poway. The reporting party, Dan Sedereff, stated shots were 
fired in the synagogue. 

10. During a briefing by the SDSD following the incident, it was reported 
that a white male, later identified as John Earnest, entered the synagogue through 
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the front door and fired several rounds from an AR15 rifle. He then proceeded 
further into the synagogue where he began firing rounds. 

11. The SDSD stated that inside the synagogue was off-duty Border Patrol 
Agent Jonathan Morales who retrieved a revolver weapon from one of the 
congregation members and chased the suspect out of synagogue firing four shots at 
him as he got into a silver Honda that was parked across the street from the church. 
The Honda fled northbound on Rancho Bernardo Road. Morales then returned the 
gun to the congregation members who placed it in a black prayer bag and left it in 
the synagogue. 

12. It was determined by officers that four people were shot and transported 
to the hospital. 

13. SDSD Deputies responded to the synagogue along with paramedics. 
The synagogue was secured by deputies pending obtaining a search warrant from 
state authorities, which was planned to be executed later that day. 

14. The same day (April 27, 2019), at approximately 11:30 a.m., a male 
who identified himself as John Earnest called into California Highway Patrol 
emergency line stating that he had fired shots into the synagogue and was willing to 
surrender to law enforcement. Earnest called from phone number 858.999.1461. 
Earnest gave his location as Phil's BBQ at 17051 West Bernardo Center Dr. He 
stated he was in possession of an AR15 Smith & Wesson MP15 rifle and several 
rounds of ammunition in his vehicle but that he would not use them against law 
enforcement. During that call, Earnest made the following comments, among others: 
“I just shot up a synagogue. I’m defending my country ... I’m just trying to defend 
my nation against the Jewish people; they’re destroying our people ... I opened fire 
at a synagogue; I think I killed some people.” I am informed and believed that Smith 
& Wesson does not manufacture firearms in the State of California. 
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15. San Diego Police Department (“SDPD”) Officers responded to that 
location and took John Earnest into custody without further incident. Seen on the 
front passenger seat was an AR15 rifle but no handgun was visible. Additionally, in 
the vehicle was a helmet with a Go-Pro camera on it. SDPD Officers were holding 
the vehicle secure at the location pending obtaining and executing a state search 
warrant. 

16. While on scene at the vehicle, it was learned that one of the victims, 
Laurie Kaye, died as a result of gunshot wounds. 

17. During a public safety interview with SDPD Detective Rudy Castro, 
John Earnest confirmed his home address as 10134 Freeport Ct., San Diego CA. He 
further stated that there were no further weapons at the home. At that time, Earnest 
did not appear to be under the influence of a controlled substance but did appear to 
have a "flat affect" as though he was detached or unaffected by his actions. 

18. SDPD SWAT officers and Detectives responded to the residence on 
Freeport Ct. The parents of the suspect were contacted and escorted from the home 
and taken to the Sheriffs Poway substation, pending the execution of a state search 
warrant on their residence. While at the substation, the parents informed law 
enforcement that their son frequently uses a computer in their home. 

19. Using various search methods, Whitney Buckingham an SDSD system 
data miner, found a manifesto on Pastebin.com written by a person identifying 
himself as John Earnest. In the manifesto, which he named "An Open Letter", 
Earnest made many anti-Semitic and anti-muslim statements. One such statement 
which is a direct quote is, "As an individual, I can only kill so many Jews." He states 
he is not a terrorist but that he hates anyone who he sees as a threat to his country. 
Earnest took credit for a fire that had been set at mosque in Escondido a few weeks 
earlier. His exact statement was "I scorched a mosque in Escondido with gasoline a 
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week after Brenton Tarrant's sacrifice and they never found shit on me." 
Additionally, he wrote "I spray-painted on the parking lot. I wrote 'For 
Brenton Tarrant-t./pol/." 

20. FBI Special Agent Maria Solomon observed part of the post -Miranda 
statement of Earnest. During that interview, he informed an SDSO Detective that 
he had adopted his ideology of hate for members of the Jewish religion 
approximately 18 month earlier. Based on my training and experience, I know that 
there is a process in which someone undergoes adoption of radical ideologies. This 
process can take several months or several years before a person actually commits 
to those ideologies. During the interview, Earnest also stated that he was inspired 
by individuals such as Adolph Hitler and Brenton Tarrant. 

B. Dar-ul-Arqam Mosque and Islamic Center Arson 

21. Based on information received from Bureau of Alcohol, Tobacco, 
Firearms and Explosives (“ATF”) Special Agent Scott Brahin, on March 24,2019, 
an unknown individual set fire to a mosque in Escondido, California. 

22. Specifically, on March 24,2019, at approximately 3:19 a.m., a 911 call 
was placed to report a fire at the Dar-ul-Arqam Mosque and Islamic Center 
(“mosque”), located at 318 West 6th Avenue in Escondido, California. The 
Escondido Fire Department and then Escondido Police Department (“EPD”) 
responded. First responders learned approximately seven individuals had been 
spending the night at the mosque and, at approximately 3:15 a.m., they had observed 
flames and rushed outside to extinguish them with a fire extinguisher. First 
responders noticed ash or charring along approximately half the length of the 
mosque’s west side and spray-painted writing on the asphalt parking lot near where 
the fire had occurred that read, “FOR BRENTON TARRAN r/pol/.” First responders 
also noticed the odor of, or similar to, gasoline at the location of the fire. 
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23. Investigators conducted an online search for “Brenton Tarran” and 
noted that he was arrested for the mass shootings at two mosques in New Zealand 
that occurred on March 15, 2019 and is believed to be a white supremacist. 
Investigators also learned “r/pol/” is a reference to an online political discussion 
board that has been characterized as predominately racist, espousing views 
embraced by white supremacist groups. 

24. Investigators reviewed surveillance footage retrieved from a business 
across the street from the mosque. The camera recorded an individual (“suspect”) 
park his/her four-door sedan in front of the mosque at approximately 3:00 a.m. In 
the video, the suspect exited the vehicle, walked towards the parking lot where the 
message was later found spray painted, and then returned to the vehicle. Shortly 
thereafter, the suspect again exited the car carrying a large container and walked 
toward the area of the mosque where the fire was set. A short time later, at 
approximately 3:15 a.m., a large flash of light and smoke are seen in the video and 
the suspect walked back to the vehicle and drove away westbound on West 6th 
Avenue. In surveillance videos obtained from businesses along the route, 
investigators observed that the suspect appeared to arrive at the mosque on March 
24,2019 by driving eastbound on West 9th Avenue, northbound on South Escondido 
Boulevard, and then westbound on West 6th Avenue, where he parked in front of 
the mosque. Investigators also observed, as noted above, that the suspect left the area 
by driving westbound on West 6th Avenue. Based on their review of surveillance 
videos, investigators believed that the suspect was driving a 2010 to 2015 Civic 
Honda, silver in color. 

25. Earnest’s statements in the manifesto that he set fire to the Escondido 
mosque on March 24, 2019, are corroborated by the following. At the time of his 
arrest for the synagogue shooting, Earnest was driving a 2012 Honda Civic, grey in 
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color. Additionally, the spray painted message left by the mosque arsonist was not 
released to the media. The fact that the manifesto specifically makes reference to 
that message further corroborates that Earnest committed the mosque arson. 

C. 8chan Posting 

26. Based on my training and experience, and online research, 8chan, also 
known as Infinitechan or Infinitychan (sometimes stylized as oochan), is an 
American-based website composed of user-created boards. According to Wikipedia, 
“An owner moderates each board, with minimal interaction from other site 
administration.” 

27. On April 27,2019, an Anonymous user posted on 8chan a posting with 
thread number 13192921 and posting ID number 4e267a. The posting read in part: 

It’s been real dudes. From the bottom of my heart thank you for 

everything. Keep up the infographic redpill threads. I’ve only been 

lurking for a year and a half, yet, what I’ve learned here is priceless. 

It’s been an honor. 

Livestream link is below as well as my open letter. Livestream will 

begin shortly, https://www.facebook.com/iohn.eamest.96780 

An open letter. 

https://pastebin.com/VXXFQMTW 

https://www.mediafire.com/file/d9oilcmibenxiyz/Open Letter.pdf.file 

28. As discussed above, agents observed the content at the above described 
pastebin.com address and observed an open letter believed to be written by Earnest. 
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Additionally, on April 27, 2019, Greg Simon of the SDPD located the above 

described posting that included information about a livestream using a Facebook 

account, https://www.facebook.com/iohn.earnest.96780 (i.e., Facebook Account 

Number 100035547390347, with user name “john.eamest.96780.”). On or about 

April 27,2019, following the synagogue shooting, local law enforcement authorities 

served a search warrant on Facebook for records for the “john.eamest.96780” 

Facebook account, pursuant. In response to that request, Facebook provided records 

which listed the user’s phone as 858.999.1461 (the same number Earnest used to call 

the CHP on April 27, 2019). Facebook verified the number on April 7, 2019. 

Facebook identified two additional Facebook accounts possibly utilized by the user 

of the john.earnest.96780 Facebook account, which were accessed via the same 

browser and the same electronic device. 

29. Agents observed that there were several postings responding to the 

above described posting and thread. See Appendix 1, attached to Attachment B . For 

example, on April 27,2019, a posting with ID 2d7a65 and thread number 13193230 

posted, “anyone had a decent read of his manifesto yet?” Another posting, ID 

cb34c8 and thread number 13193259, stated: 

It’s very much written for /pol/, he goes into some depth about things 
being called falseflags, about how you should start getting 
prepared...Tarrant was a much more articulate writer, and walked 
through his thought process much more, which leads to people being 
able to understand (even if they can’t publicly admit) why he did what 
he did. Earnest’s honest passion is his highlight and his weakness - no 
boomer is going to read this and suddenly became aware of the JQ.” 

Another April 27, 2019 with ID 078285 and thread number 13193283 posted an 
image of a news station article posted on April 27, 2019 at 12:11 pm. The headline 
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stated, “Multiple people gunned down at Poway Synagogue, police search for 
shooter.” 

D. Basis for Information Sought 

30. Agents seek IP address and metadata information about Earnest’s 
original posting and the postings of all of the individuals who responded to the 
subject posting and/or commented about it. Additionally, agents seek information 
about any other posting coming from the IP address used by Earnest to post the 
subject posting. 

31. As discussed above, Earnest made a posting in which he thought to 
draw attention to his forthcoming attack on the Chabad of Poway, share his views 
through his open letter, and offer people the opportunity to observe the attack itself. 
Several people responded, both individuals who were taken aback about the posting 
as well as people who were sympathizers. As a result, some of the individuals may 
be potential witnesses, co-conspirators and/or individuals who are inspired by the 
subject posting. Based on agents’ training and experience, following attacks such 
as those conducted by Earnest, other individuals are inspired by the attacks and may 
act of their own accord. For example, as described above, Earnest himself was 
inspired by the Christchurch event in New Zealand. Regardless of the nature of the 
comments, the evidence sought to be seized as described in Attachment B is relevant 
as evidence of Earnest’s bias and motivation in committing the hate crimes set forth 
in Attachment B. Even comments made in response to the subject posting or about 
it are relevant to Earnest’s motivation for his violent attacks to the extent that as 
explained above, some of the posters may be potential witnesses, co-conspirators 
and/or individuals who are inspired by the subject posting. As discussed above, 
Earnest stated in the subject posting, “I’ve only been lurking for a year and a half, 
yet, what I’ve learned here is priceless.” This information suggests that Earnest was 
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inspired and/or educated by individuals who commented on his threads. Based on 
this information, there is reasonable cause to believe that the information sought, 
specifically IP address and metadata for all commenters, constitute evidence of his 
motivation in committing the offenses described herein and are thus relevant and 
material to an ongoing criminal investigation, information that may be sought by an 
order issued pursuant to 18 U.S.C. § 2703(c) and (d). That is, the information may 
lead to the identity of individuals who inspired and/or educated Earnest or are aware 
of his motivation in committing the attacks. 

32. FBI agents have consulted with 8ch.net about the kind of information 
that the website maintains and understand that 8ch.net is an anonymous imageboard 
and users are not required to create an account or use a name or an email address to 
post. Hence, regular users usually have no usernames or email addresses linked to 
their posts. However, agents have also learned that 8ch.net has used data forensics 
in the past to find information about individuals who have posted on 8ch.net, 
including IP address and metadata information (although not if the thread or post has 
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| m. SEARCH PROTOCOL to tW. 1 U;-- . ^ , . 
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33. Based upon my experience and training, and the experience and training 11 

of other agents with whom I have consulted with, electronically stored data can be 
permanently deleted or modified by users possessing basic computer skills. In this 
case, only if the subject receives advance warning of the execution of this warrant, 
will there be a genuine risk of destruction of evidence. 

B. Prior Attempt to Obtain Evidence 

34. The United States is aware that individual users of ch.net contacted law 
enforcement authorities about the subject posting and may have provided the subject 
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posting to law enforcement authorities. The United States is unaware of other efforts 
except as described herein. 

C. Ch.net 

35. Ch.net is an Internet company that, among other things, provides electronic 
communication services to its subscribers. Ch.net's electronic mail service allows 
its subscribers to exchange electronic communications with others through the 
Internet. 

36. At the creation of a Ch.net account and for each subsequent access to 
the account, Ch.net logs the Internet Protocol ("IP") address of the computer 
accessing the account. An IP address is a unique address through which a computer 
connects to the Internet. IP addresses are leased to businesses and individuals by 
Internet Service Providers. Obtaining the IP addresses that have accessed a 
particular Ch.net account often identifies the Internet Service Provider that owns and 
has leased that address to its customer. Subscriber information for that customer 
then can be obtained using appropriate legal process. 

D. Procedures for Electronically Stored Information 

37. Federal agents and investigative support personnel are trained and 
experienced in identifying communications relevant to the crimes under 

i 

investigation. The personnel of Ch.net are not. It would be inappropriate and 
impractical for federal agents to search the vast computer network of Ch.net for the 
relevant accounts and then to analyze the contents of those accounts on the premises 
of Ch.net. The impact on Ch.net’s business would be severe. 

38. Therefore, I request authority to seize all content, including electronic 
mail and attachments, stored instant messages, stored voice messages, photographs 
and any other content, as described in Attachment B. In order to accomplish the 
objective of the search warrant with a minimum of interference with the business 
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activities of Ch.net, to protect the rights of the subject of the investigation and to 
effectively pursue this investigation, authority is sought to allow Ch.net to make a 
digital copy of the entire contents of the accounts subject to seizure. That copy will 
be provided to me or to any authorized federal agent. The copy will be forensically 
imaged and the image will then be analyzed to identify communications and other 
data subject to seizure pursuant to Attachment B. Relevant data will be copied to 
separate media. The original media will be sealed and maintained to establish 
authenticity, if necessary. 

39. Analyzing the data to be provided by Ch.net may require special 
technical skills, equipment and software. It also can be very time-consuming. 
Searching by keywords, for example, often yields many thousands of “hits,” each of 
which must be reviewed in its context by the examiner to determine whether the data 
in within the scope of the warrant. Merely finding a relevant “hit” does not end the 
review process. Certain file formats do not lend themselves to keyword searches and 
keyword search text. Many common electronic mail, database and spreadsheet 
applications, which files may have been attached to electronic mail, do not store data 
as searchable text. The data is saved in a proprietary non-text format. The volume of 
storage allotted by service providers increases, the time it takes to properly analyze 
recovered data increases dramatically. 

40. Based on the foregoing, searching the recovered data for the 
information subject to seizure pursuant to this warrant may require a range of data 
analysis techniques and may take weeks or even months. Keywords need to be 
modified continuously based upon the results obtained. The personnel conducting 
the examination will complete the analysis within (90) days of receipt of the data 
from the service provider, absent further application to this court. 
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41. B ased upon my experience and training, and the experience and training 
of other agents with whom I have communicated, it is necessary to review and seize 
all posting that identify any poster of the subject posting and any postings sent or 
received in temporal proximity to incriminating electronic mails that provide context 
to the incrimination mails. 

42. All forensic analysis of the imaged data will employ search protocols 
directed exclusively to the identification and extraction of data within the scope of 
this warrant. 

IV. REQUEST FOR SEALING AND PRECLUSION OF NOTICE 

43. Although John Earnest has been arrested by state authorities, he is 
unaware of the scope and nature of law enforcement’s investigation into his 
activities. Additionally, law enforcement is still investigating whether he acted 
alone, or conspired with others or was inspired by others. As such, there is reason 
to believe that that disclosure of the affidavit and warrant will result in destruction 
of or tampering with evidence or otherwise seriously jeopardize the investigation. 
Accordingly, it is requested that this warrant and its related materials be sealed until 
further order of the Court. In addition, pursuant to Title 18, United States Code, 
Section 2705(b), it is requested that this Court order Ch.net to whom this warrant is 
directed not to notify anyone of the existence of this warrant, other than its personnel 
essential to compliance with the execution of this warrant until October 28, 2019, 
absent order from the Court. 

V. CONCLUSION 

44. Based on the foregoing, your affiant submits that there is probable 
cause to believe that violations of federal criminal law, namely, violations of federal 
law, namely, intentional obstruction, by force or threat of force of persons in the free 
exercise of religious belief, resulting in death, in violation of 18 U.S.C. § 247(a)(2), 
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willfully causing bodily injury to persons through the use of a firearm because of the 
actual or perceived religion of said persons, resulting in death, in violation of 18 
U.S.C. § 249(a)(1), and damage to religious property, in violation of 18 U.S.C. § 
247(a)(1), have occurred, and that evidence of said violations, as described in 
Attachment B will be found within the subject posting and all the postings of all of 
the individuals who responded to the subject posting and/or commented about his 
posting. 


I declare under penalty of perjury under the laws of the United States that the 
foregoing is true and correct. 



Michael J. Rod 
FBI, Special Agent 


Sworn to before me this 
2^ ' day of April_2019 




n\ Jill L. Burkhardt 



ED STATES MAGISTRATE JUDGE 
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ATTACHMENT A 



This warrant applies to information associated with 8chan posting with ID 

iA vts-po ' 

4e267a and No. 13192921 and all postings by individuals who responded to said 
posting and^r^o^nmgntfd^about the posting, owned, maintained, controlled, or 
operated by 8ch.net, 9120 Double Diamond Parkway, Suite 5901, Reno, NV 89521. 
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ATTACHMENT B 


All information, including but not limited to, IP address and metadata 
information, related to 8chan posting with ID 4e267a and No. 13192921 and all postings 
by individuals w^oT^s^on^ d to said posting and/or oemmerrte¥ about said posting, as (\ $ 
well as all postings made by the same IP addresses that were used to post ID 4e267a 
and No. 13192921, uuWgU 0 * 
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